UNITED STATES DEPARTMENT OF COMMERCE 
Office of Inspector General 

Washington, DC 20230 

September 5, 2019 

VIA E-MAIL 

Emma Best 
MuckRock News 
DEPT MR 74285 
411A Highland Ave. 

Somerville, MA 02144-2516 



RE; EOIA Appeal No. DOC-OIG-2019-001994 of EOIA Request No. DOC-OIG-2019-001466 
Dear Ms. Best: 

This responds to your Ereedom of Information Act (EOIA) appeal dated August 2, 2019,^ in 
which you sought review of the Office of Inspector General’s (OIG’s) administrative closure of 
your EOIA request dated June 5, 2019 (DOC-OIG-2019-001466). Your June 5, 2019 EOIA 
request sought copies of records “mentioning or describing audits, reviews, investigations or 
reports regarding the agency's cyber security, including audits or investigations regarding the 
state of the agency's cyber security regarding potential attacks as well as audits and 
investigations conducted in the wake of a suspected or actual cyber attack, hacking incident or 
breach. Please include materials generated between 1 January 1996 and 30 June 2016.” 

According to the OIG’s records, on June 5, 2019, the same day that the OIG received your EOIA 
request, the OIG sent you an email acknowledging receipt of your request and informing you that 
your request was overbroad. The email further explained that there is a legal requirement that 
EOIA requests must identify the records being sought with sufficient specificity,^ and that your 
June 5, 2019 request did not. The email invited you to narrow or modify the scope of your 
request, and the OIG volunteered to assist you in this process. Einally, the email notified you 
that if you did not comply with the OIG’s instructions to identify the records with sufficient 
specificity by July 5, 2019, then no further action would be taken on the EOIA request and it 
would be administratively closed. 


' The OIG received this appeal on August 15, 2019. 
2 See 15 C.F.R. §4.4(c) 
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After the OIG did not receive a response you, the OIG sent you a formal letter, via email, on July 
5, 2019, notifying you that your request was being administratively closed. The OIG closed your 
request because you had failed to respond to the OIG’s request for clarification and the letter 
further stated that the OIG would be unable to continue processing this request. The formal 
letter also explained that if you continue to seek OIG records, you may file a new request. 

In your August 2, 2019 FOIA appeal, you challenged the OIG’s administrative closure of your 
June 5, 2019 FOIA request. Your appeal states: 

“I am appealing the decision to close the FOIA, as the request for further 
information was recalled, see https://www.muckrock.com/foi/united-states-of- 
america-10/inspector-general-infosec-audits-etc-1996-20165-department-of- 

commerce-office-of-inspector-general-74891/#comm-734777 . Closing the FOIA 
for a failure to comply with a withdrawn request for clarification is highly 
inappropriate.” 

From the OIG’s reading, the sole basis under which this appeal is challenging the OIG’s 
administrative closure of the June 5, 2019 FOIA request is your contention that the request for 
clarification was “recalled.” 

Possibly Recalled Email 

The facts as described above reflect the OIG’s record and the OIG’s knowledge of the 
communications pertaining to this FOIA request. The OIG FOIA email account has no record in 
its Sent Mail box of sending a recall notice to the email address associated with the June 5, 2019 
FOIA request.^ Moreover, the OIG Government Information Specialist responsible for handling 
these communications has no recollection of issuing a recall notice. Therefore, the OIG had no 
reason to believe that it issued a recall notice for the June 5, 2019 email requesting clarification. 
Based on the OIG’s record and knowledge of communications, the July 5, 2019 administrative 
closure was appropriate. 

Your FOIA appeal appears to rely upon a different set of facts. There is no statement in your 
August 2, 2019 appeal explaining the assertion that the OIG’s request for clarification was 
withdrawn. Although your appeal cites to a webpage address maintained by the appellant, it 
provides no explanation of what that webpage is or how its information is generated or 
maintained. Upon visiting that webpage, it appears to the OIG that the webpage purports to be a 
collection of the text of the communications pertaining to the June 5, 2019 FOIA. The webpage 
does not appear to maintain the original communications, nor does it have many details about the 
communications such as timestamps or other metadata. A copy of the webpage as viewed by the 
OIG is attached. The communications appear to be in descending chronological order, with the 

^ The OIG also has no record of sending its request for clarification email twice. 
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email initiating the FOIA request at the top and the email acknowledging receipt of FOIA appeal 
at the bottom. However, without additional information and support concerning the accuracy 
and validity of the information the website, the OIG cannot assume that it is correct. 

Even if the OIG were to assume that the webpage’s content is accurate, based on its contents, it 
would be unreasonable to assume that the OIG withdrew its request for clarification. The first 
communication from the OIG appearing on that webpage was a recall notice that simply stated, 
“OIG FOIA would like to recall the message, ‘FOIA DOC-OIG-20I9-OOI466 - Action 
Required.’” This language appears to be the language automatically generated by Microsoft 
Outlook when attempting to recall an email and does not in any way discuss the substance of the 
FOIA request or the OIG’s request for clarification. The most reasonable interpretation of this 
email is that the OIG recalled a message that it had inadvertently previously sent, which is why it 
does not appear on the webpage. Proceeding down the webpage, the next two messages the OIG 
sent appear to have been exact duplicates of each other and both contained the OIG’s 
acknowledgment of receipt of the FOIA request as well as the OIG’s request for clarification. 
Moreover, both explicitly stated, “[i]f you fail to provide sufficient detail by July 5, 2019, we 
will notify you in writing that your request has not been properly made, that no further action 
will be taken, and that your request is closed.” If one were to ignore that the recall message 
came first, it would be reasonable for a person to receive those three messages, believe that the 
duplicate acknowledgment and request for clarification was sent in error, and conclude that the 
recall email was intended to recall only the duplicate. It would not be reasonable for someone to 
believe that a message to recall an email sent in error was intended to withdraw and negate 
multiple emails that followed it. As there were two messages mandating clarification of the 
FOIA request and only one recall message, according to the webpage cited in the appeal, you 
would have received sufficient information to put you on notice that you needed to communicate 
with the OIG FOIA contact prior to July 5, 2019. As you did not, the OIG’s administrative 
closure of your request would have been appropriate even under these circumstances. 

Whether viewed from the perspective of the records maintained by the OIG or those maintained 
on the muckrock.com website, the chain of communications between the OIG and the requester 
would lead a reasonable person to believe that OIG required clarification to proceed with 
processing the FOIA request and that the request would be closed if no such clarification was 
provided by July 5, 2019. Thus, the assertion in the August 2, 2019 FOIA appeal that the OIG’s 
request for clarification was withdrawn is unreasonable and not supported by the facts provided. 
Accordingly, the administrative closure of the FOIA request was proper. 
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Requirements of a FOIA Request 


For your information,"^ FOIA requests must 

“reasonably deseribe the agency records sought, to enable Department personnel to 
locate them with a reasonable amount of effort.... Whenever possible, a request 
should include specific information about each record sought, such as the date, title 
or name, author, recipient, and subject matter of the record, case number, file 
designation, or reference number, and the name and location of the office where the 
record might be found.” 

15 C.F.R. §4.4(c). Moreover, as a corollary to the “reasonably describe[d]” inquiry requirement 
cited above, courts have held that agencies are not required to conduct wide-ranging, 
“unreasonably burdensome” searches for records. See, e.g., Nation Magazine v. U.S. Customs 
Serv., 71 F.3d 885, 892 (D.C. Cir. 1995) (agreeing that search requiring review of twenty-three 
years of unindexed files would be unreasonably burdensome); AFGE v. U.S. Dep't of Commerce, 
907 F.2d 203, 209 (D.C. Cir. 1990) (holding that "while [plaintiffs requests] might identify the 
documents requested with sufficient precision to enable the agency to identify them ... it is clear 
that these requests are so broad as to impose an unreasonable burden upon the agency," because 
agency would have "to locate, review, redact, and arrange for [the] inspection [of] a vast quantity 
of material"). Should you opt to file a new request for OIG records, please keep these principles 
in mind. 

Conclusion 


Your appeal is denied. FOIA Request DOC-OIG-2019-001466 will remain administratively 
closed due to your failure to contact the OIG within the allotted period to clarify your request. 
This is the final decision of the OIG. 

You have the right to seek judicial review of this partial denial, as provided in 5 U.S.C. 

§ 552(a)(4)(B). Further, the 2007 FOIA amendments created the Office of Government 
Information Services (OGIS) to offer mediation services to resolve disputes between FOIA 
requesters and federal agencies as a non-exclusive alternative to litigation. Using OGIS services 
does not affect your right to pursue litigation. You may contact OGIS in any of the following 
ways: 


The relevant legal standards were not discussed in the August 2, 2019 FOIA appeal, and this information is being 
provided solely for your benefit. 
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Office of Government Information Services 

National Archives and Records Administration 

8601 AdelphiRoad-OGIS 

College Park, MD 20740-6001 

E-mail: ogis@nara.gov 

Web: https://ogis.archives.gov/ 

Telephone: 202-741-5770 
Fax: 202-741-5769 
Toll-free: 1-877-684-6448 

Nothing in this decision affects or forecloses your ability to file a new FOIA request seeking 
documents from the OIG. 


Sincerely, 


E. GREEN 


Digitally signed by E. 
GREEN 

Date: 2019.09.05 
14:35:01 -04'00’ 


Wade Green, Jr. 

Counsel to the Inspector General 


Enclosure 
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8/26/2019 


Inspector General Infosec audits etc. 1996-2016.5 (Department of Commerce, Office of Inspector General) • MuckRock 


Sign Up Login 

Inspector General infosec audits etc. 1996-2016.5 
(Department of Commerce, Office of Inspector General) 

Share 


Emma Best filed this request with the Department of Commerce, Office of Inspector 
General of the United States of America. 


It is a clone of this request. 


Tracking# 

DOC-OIG-2019-001466 

Multi Request 

Inspector General infosec audits etc. 1996-2016.5 


Submitted 

Junes, 2019 

Est. Completion 

None 

STATUS 

Awaiting Appeal 


PROJECTS 
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MuckRock users can file, duplicate, track, and share public records 
requests like this one. Learn more. 


File a Request 


7 Communications 
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Inspector General Infosec audits etc. 1996-2016.5 (Department of Commerce, Office of Inspector General) • MuckRock 



Q. 


Sign Up Login 


From: Emma Best 


06/05/2019 


Subject: Freedom of Information Act Request: Inspector General infosec audits etc. 1996-2016.5 (Department of Co... Email 
To Whom It May Concern: 

Pursuant to the Freedom of Information Act, I hereby request the following records: 

Copies of records mentioning or describing audits, reviews, investigations or reports regarding the 
agency's cyber security, including audits or investigations regarding the state of the agency's cyber 
security regarding potential attacks as well as audits and investigations conducted in the wake of a 
suspected or actual cyber attack, hacking incident or breach. Please include materials generated 
between 1 January 1996 and 30 June 2016. 

The requested documents will be made available to the general public, and this request is not being 
made for commercial purposes. 

In the event that there are fees, I would be grateful if you would inform me of the total charges in advance 
of fulfilling my request. I would prefer the request filled electronically, by e-mail attachment if available 
or CD-ROM if not. 

Thank you in advance for your anticipated cooperation in this matter. I look forward to receiving your 
response to this request within 20 business days, as the statute requires. 


Sincerely, 


Emma Best 


Fee20category20and20search20parameters.pdf 

oView <A Embed Download 


From: Department of Commerce, Office of Inspector General 


06/05/2019 


Subject: Recall: FOIA DOC-OlG-2019-001466 - Action Required 


Email 


OIG FOIA would like to recall the message, "FOIA DOC-OIG-2019-001466 - Action Required". 


From: Department of Commerce, Office of Inspector General 


06/05/2019 


Subject: FOIA DOC-OlG-2019-001466 - Action Required 


Email 


Emma Best 
411A Highland Ave. 


https://www.muckrock.com/fol/unlted-states-of-amerlca-10/inspector-general-lnfosec-audlts-etc-1996-20165-department-of-commerce-offlce-of-lnspect... 2/6 














8/26/2019 


Inspector General Infosec audits etc. 1996-2016.5 (Department of Commerce, Office of Inspector General) • MuckRock 



Sign Up Login 


Re: FOIA DOC-OIG-2019-001466 


Dear Ms. Best: 


This email is to acknowledge receipt of your Freedom of Information Act (FOIA) request, received by the 
Department of Commerce, Office of Inspector General (OIG) on June 5,2019, in which you seek copies of 
"records mentioning or describing audits, reviews, investigations or reports regarding the agency's cyber 
security, including audits or investigations regarding the state of the agency's cyber security regarding 
potential attacks as well as audits and investigations conducted in the wake of a suspected or actual 
cyber attack, hacking incident or breach. Please include materials generated between 1 January 1996 
and 30 June 2016." The tracking number for your request is DOC-OIG-2019-001466. Please refer to this 
number in all correspondence regarding your request. 

We ask that you narrow your request to a more specific time period and/or division or office of the Office 
of the Inspector General as we find that in its current status it is very broad. Pursuant to Department of 
Commerce FOIA regulations at 15 C.F.R. § 4.4(c), a "FOIA request must reasonably describe the agency 
records sought, to enable Department personnel to locate them with a reasonable amount of effort. 
Whenever possible, a request should include specific information about each record sought, such as the 
date, title or name, author, recipient, and subject matter of the record, and the name and location of the 
office where the record might be found." Your request does not reasonably describe the records sought; I 
am available to discuss your request if you would like to reformulate or modify your request. If you fail to 
provide sufficient detail by July 5,2019, we will notify you in writing that your request has not been 
properly made, that no further action will be taken, and that your request is closed. 

If you have any questions regarding your request, please contact me or Laura Main, Government 
Information Specialist, by phone at (202) 482-5992 or via e-mail at FOIA(S)oig.doc.gov. 


U.S. Department of Commerce 
Office of Inspector General 
Room 7896 

1401 Constitution Avenue, N.W. 
Washington, D.C. 20230 


Tel: (202) 482-5992 

FOIA(a)oig.doc.gov<mailto:FOIA(a)oig.doc.gov> 
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rj Download 



https://www.muckrock.com/fol/unlted-states-of-amerlca-10/inspector-general-lnfosec-audlts-etc-1996-20165-department-of-commerce-offlce-of-lnspect... 3/6 
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Inspector General Infosec audits etc. 1996-2016.5 (Department of Commerce, Office of Inspector General) • MuckRock 

Sign Up Login 

Emma Best 
411A Highland Ave. 

DEPT MR 74891 
Somerville, MA 02144 

Re: FOIA DOC-OIG-2019-001466 

Dear Ms. Best: 

This email is to acknowledge receipt of your Freedom of Information Act (FOIA) request, received by the 
Department of Commerce, Office of Inspector General (OIG) on June 5,2019, in which you seek copies of 
"records mentioning or describing audits, reviews, investigations or reports regarding the agency's cyber 
security, including audits or investigations regarding the state of the agency's cyber security regarding 
potential attacks as well as audits and investigations conducted in the wake of a suspected or actual 
cyber attack, hacking incident or breach. Please include materials generated between 1 January 1996 
and 30 June 2016." The tracking number for your request is DOC-OIG-2019-001466. Please refer to this 
number in all correspondence regarding your request. 

We ask that you narrow your request to a more specific time period and/or division or office of the Office 
of the Inspector General as we find that in its current status it is very broad. Pursuant to Department of 
Commerce FOIA regulations at 15 C.F.R. § 4.4(c), a "FOIA request must reasonably describe the agency 
records sought, to enable Department personnel to locate them with a reasonable amount of effort. 
Whenever possible, a request should include specific information about each record sought, such as the 
date, title or name, author, recipient, and subject matter of the record, and the name and location of the 
office where the record might be found." Your request does not reasonably describe the records sought; I 
am available to discuss your request if you would like to reformulate or modify your request. If you fail to 
provide sufficient detail by June 5,2019, we will notify you in writing that your request has not been 
properly made, that no further action will be taken, and that your request is closed. 

If you have any questions regarding your request, please contact me or Laura Main, Government 
Information Specialist, by phone at (202) 482-5992 or via e-mail at FOIA(a)oig.doc.gov. 

U.S. Department of Commerce 
Office of Inspector General 
Room 7896 

1401 Constitution Avenue, N.W. 

Washington, D.C. 20230 

Tel: (202) 482-5992 

FOIA(a)oig.doc.gov<mailto:FOIA(a)oig.doc.gov> 

_ 
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Inspector General Infosec audits etc. 1996-2016.5 (Department of Commerce, Office of Inspector General) • MuckRock 



Q. 


Sign Up Login 


From: Department of Commerce, Office of Inspector General 


07/05/2019 


Subject: RE: Freedom of Information Act Request: Inspector General infosec audits etc. 1996-2016.5 (Department o... Email 

Please see the attached response to your FOIA request. 

U.S. Department of Commerce 
Office of Inspector General 
Room 7896 

1401 Constitution Avenue, N.W. 

Washington, D.C. 20230 


Tel: (202) 482-5992 

FOIA(a)oig.doc.gov<mailto:FOIA(a)oig.doc.gov> 







2019-001466_Administrative Close Out Letter_Failure to Clarify Letter PDF 
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From: Emma Best 08/02/2019 

Subject: RE: Freedom of Information Act Request #DOC-OIG-2019-001466 Mail 

I am appealing the decision to close the FOIA, as the request for further information was recalled, see 
https://www.muckrock.com/foi/united-states-of-america-10/inspector-general-infosec-audits-etc-1996- 
20165-department-of-commerce-office-of-inspector-general-74891/#comm-734777. Closing the FOIA for 
a failure to comply with a withdrawn request for clarification is highly inappropriate. 




2019-001466_Administrative Close Out Letter_Failure to Clarify Letter PDF 
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From: Department of Commerce, Office of Inspector General 08/16/2019 

Subject: FOIA Appeal No. DOC-OIG-2019-001994 of FOIA Request No. DOC-OIG-2019-001466 Email 

Please see the attached acknowledgement of you FOIA Appeal DOC-OIG-2019-001994. 


u s Dpnartmpnt of rnmmprrp 

https://www.muckrock.com/fol/unlted-states-of-amerlca-10/inspector-general-lnfosec-audlts-etc-1996-20165-department-of-commerce-offlce-of-lnspect... 5/6 
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Inspector General Infosec audits etc. 1996-2016.5 (Department of Commerce, Office of Inspector General) • MuckRock 
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1401 Constitution Avenue, N.W. 

Washington, D.C. 20230 

Tel: (202) 482-5992 

FOIA(a)oig.doc.gov<mailto:FOIA(a)oig.doc.gov> 


2019-001994 Acknowledgement Letter SIGNED 
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